How to secure your crypto exchange account: 2FA, anti-phishing code, whitelist
Six settings that close the most common ways exchange accounts get taken over. It takes about half an hour.
4 min read · Updated: 2026-10-19
In short
Most account takeovers are not the work of genius hackers. They exploit a weak link: an SMS code, an old email, a phishing link or a forgotten API key. Close them in order:
- 2FA through an app or a security key, not SMS.
- An anti-phishing code.
- A withdrawal whitelist.
- Careful API keys.
- A strong, separate email.
- SIM-swap protection for your phone number.
1. App-based 2FA, not SMS
Two-factor authentication asks for a second code on top of your password. Not all codes are equally safe.
| Method | Safety | Why |
|---|---|---|
| SMS | Low | Your number can be moved to a scammer's SIM |
| Authenticator app | Good | The code is generated on your phone |
| Security key or passkey | Highest | It does not work on a phishing site |
- Install an authenticator app from the official app store.
- In the exchange's security settings, turn on app-based 2FA and scan the QR code.
- Save the backup key or recovery codes on paper, not in notes or the cloud.
- Then turn off SMS as a login method if the exchange allows it.
Never share 2FA codes. Neither support nor the exchange's "security team" will ever ask for them.
2. Anti-phishing code
An anti-phishing code is a word you set in your settings, and the exchange puts it in every email it sends you. If an email "from the exchange" arrives without your code, it is phishing.
- Pick a word that has nothing to do with you and cannot be guessed.
- Remember: the code protects you from fake emails, not from a fake website. Open the exchange only from a bookmark.
More on common tricks in how to spot crypto scams and phishing.
3. Withdrawal whitelist
A withdrawal whitelist only allows withdrawals to addresses you saved in advance. If someone gets into your account, they cannot instantly send your money to their own wallet.
- Add your own wallet addresses to the address book and turn on "withdraw only to whitelisted addresses".
- Check that a new address only becomes usable after a delay (often 24 hours or more). That gives you time to notice someone else's activity.
- Turn on login and withdrawal alerts by email or in the app.
4. API key hygiene
An API key gives a program access to your account: a trading bot, a tax tool or a portfolio tracker. A leaked key is a leaked login.
- Least privilege. A tracker or tax tool only needs read-only. A bot needs trading. Almost never turn on withdrawals.
- IP restriction. If the service publishes fixed IP addresses, lock the key to them.
- One key per service. You know who does what, and you can revoke one key without breaking the rest.
- Lifetime. Delete keys you no longer use and review the list every few months.
- Keep the secret secret. Never paste a key into chats, screenshots or public code.
A service that asks for an API key with withdrawal rights "for the strategy to work" is almost certainly a scam.
For experimenting with bots, a sub-account with a small balance is handy.
5. Email is the master key
Passwords are reset through email, so whoever controls your email nearly controls your account.
- Use a separate address only for finance and exchanges, and never publish it.
- Give the email a long, unique password and 2FA through an app or security key.
- Make sure the recovery phone and recovery email are current and protected too.
- Check forwarding and filter settings: attackers often quietly add a rule that forwards exchange emails to them.
- Use a password manager: it will not fill in your password on a site with a fake address.
6. SIM-swap protection
A SIM swap is when a scammer talks or bribes a mobile carrier employee into moving your number onto their SIM card. From then on, they receive your SMS codes.
- Remove your phone number as a login and recovery method wherever you can.
- Ask your carrier whether you can set a PIN or block SIM changes without an in-person visit.
- Do not post your number on social media or public profiles.
- If your phone suddenly loses signal for no reason, call your carrier right away and check your accounts.
If something goes wrong
- Freeze the account immediately: most exchanges have a "disable account" button or an urgent support line.
- Change your email and exchange passwords from a clean device.
- Revoke all API keys and log out of all sessions.
- Check your withdrawal history and the whitelist.
If "crypto recovery experts" contact you, that is a second wave of the scam. Only deal with the exchange's support and the police.
Questions and answers
Why is SMS 2FA considered unsafe?
Your number can be moved to someone else's SIM card through the carrier (a SIM swap), and then the codes go to the scammer. An authenticator app or a security key is much safer.
What is an anti-phishing code on an exchange?
A secret word the exchange adds to every email it sends you. If an email "from the exchange" does not contain it, the email is fake.
What permissions should an API key have?
Only what is needed: read-only for trackers and tax tools, trading for bots. Avoid giving withdrawal rights at all, and lock the key to an IP address.
What if I lose the phone with my authenticator?
Restore 2FA with the backup key or recovery codes you saved during setup. Without them you will need account recovery through the exchange's support with identity checks, which can take several days.